Bonjour,
Je fais un petit ré-up de ma question ayant de nouveau éléments et donc de nouvelles interrogations.
Bon j'ai bien potassé les acl j'ai compris plein de choses et d'autres me reste encore obscure mais bon on avance :)
Alors voila j'ai refait mes ACL en respectant un ordre qui est censé permettre leur bon fonctionnement :
# ACL 1
# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword
by dn="cn=admin,dc=immaculee,dc=net" write
by dn="cn=adminro,dc=immaculee,dc=net" read
by anonymous auth
by self write
by * none
# ACL 2
# régit les accès au paramètres de horde
access to attrs=hordePrefs,impPrefs,mailforward,vacationActive,vacationInfo
by self write
by * read
# ACL 3
# allow user to create entries in own addressbook; no-one else can access it
# needs write access to the entries ENTRY attribute (ACL4) and the
entries CHILDREN (ACL3)
access to dn.regex="ou=personal_addressbook,cn=([^,]+),ou=people,dc=immaculee,dc=net$"
attrs=children
by dn.regex,expand="cn=$1,ou=people,dc=immaculee,dc=net" write
by users none
# ACL 4
# allow one to create entries in its own addressbook; no-one else can access it
# needs write access to the entries ENTRY attribute (ACL4) and the
entries CHILDREN (ACL3)
access to dn.regex="ou=personal_addressbook,cn=([^,]+),ou=people,dc=immaculee,dc=net$"
attrs=entry
by dn.regex,expand="cn=$1,ou=people,dc=immaculee,dc=net" write
by users none
# ACL 5
# allow access to all entries in own addressbook; no-one else can access it
access to dn.regex="ou=personal_addressbook,cn=([^,]+),ou=people,dc=immaculee,dc=net$"
filter=(objectclass=inetorgperson)
by dn.regex,expand="cn=$1,ou=people,dc=immaculee,dc=net" write
by users none
# ACL 6
# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read
# ACL 7
# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=admin,dc=immaculee,dc=net" write
by dn="cn=adminro,dc=immaculee,dc=net" read
by * read
Le soucis c'est que çà devrait marcher mais j'ai toujours un : insufficient access error 50 quand j'essai de rentrer un contact dans mon adress book :(
mon ldaplog me donne ceci :
an 10 14:11:30 localhost slapd[4328]: slapd stopped.
Jan 10 14:11:30 localhost slapd[4362]: @(#) $OpenLDAP: slapd 2.2.23
(May 30 2005 08:52:42) $
^I@pulsar:/home/torsten/packages/openldap/openldap2.2-2.2.23/debian/build/servers/slapd
Jan 10 14:11:30 localhost slapd[4362]: daemon: IPv6 socket() failed
errno=97 (Address family not supported by protocol)
Jan 10 14:11:30 localhost slapd[4362]: bdb_db_init: Initializing BDB database
Jan 10 14:11:30 localhost slapd[4364]: slapd starting
Jan 10 14:11:35 localhost slapd[4366]: conn=0 fd=11 ACCEPT from
IP=127.0.0.1:38462 (IP=0.0.0.0:389)
Jan 10 14:11:35 localhost slapd[4367]: conn=0 op=0 BIND
dn="uid=m.ferber,ou=People,dc=immaculee,dc=net" method=128
Jan 10 14:11:35 localhost slapd[4367]: conn=0 op=0 BIND
dn="uid=m.ferber,ou=people,dc=immaculee,dc=net" mech=SIMPLE ssf=0
Jan 10 14:11:35 localhost slapd[4367]: conn=0 op=0 RESULT tag=97 err=0 text=
Jan 10 14:11:35 localhost slapd[4367]: conn=0 op=1 ADD
dn="cn=fabien,ou=m.ferber,ou=personal_addressbook,dc=immaculee,dc=net"
Jan 10 14:11:35 localhost slapd[4367]: conn=0 op=1 RESULT tag=105
err=50 text=no write access to parent
Jan 10 14:11:35 localhost slapd[4367]: conn=0 op=2 UNBIND
Jan 10 14:11:35 localhost slapd[4367]: conn=0 fd=11 closed